---
id: "CVE-2026-19256"
kind: "vulnerability"
aliases: ["CVE-2026-19256"]
title: "WordPress All In One Login plugin: weak code limits allow admin account takeover"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["all-in-one-login", "package", "self-hosted", "wordpress"]
not_affected_if: ["passwordless-login-disabled", "plugin-updated"]
published_at: "2026-11-05T06:17:08+00:00"
first_seen_at: "2026-11-05T06:31:52+00:00"
updated_at: "2026-11-05T06:33:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19256", "first_seen_at": "2026-11-05T06:31:52+00:00"}]
exploit_sources: []
---

# WordPress All In One Login plugin: weak code limits allow admin account takeover

The All In One Login WordPress plugin before 2.5.0 does not limit guesses against the short numeric code used for its default passwordless email login. Failed attempts are also not counted by its brute-force protection, so an unauthenticated attacker can guess the code and log in as any account, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin plugin list or in `wp-content/plugins/` for the All In One Login plugin; versions below `2.5.0` are in scope.
- Check whether the passwordless email login feature is enabled in the plugin settings (the sources say it is enabled by default).

## Fix

- All In One Login plugin: move to `2.5.0` or later (the sources state the fix is in versions before 2.5.0; the exact fixed version is per the NVD range).

## Timeline

- 2026-11-05T06:31:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-19256

## From the sources

The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_